diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-01 16:19:51 -0800 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-02 10:31:28 -0800 |
| commit | 349b7977e408f18cff01ab31dfa66c8249b6584a (patch) | |
| tree | 3ed1960676d4b9552e738c48a1bd187eb9a042e0 /libavcodec/wma.h | |
| parent | 9d25f1f6194dba9cfd60c0596aa59ad145d61382 (diff) | |
wma: fix invalid buffer size assumptions causing random overreads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/wma.h')
| -rw-r--r-- | libavcodec/wma.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/wma.h b/libavcodec/wma.h index 4acbf04bbf..d6f4880c14 100644 --- a/libavcodec/wma.h +++ b/libavcodec/wma.h @@ -124,7 +124,7 @@ typedef struct WMACodecContext { /* output buffer for one frame and the last for IMDCT windowing */ DECLARE_ALIGNED(32, float, frame_out)[MAX_CHANNELS][BLOCK_MAX_SIZE * 2]; /* last frame info */ - uint8_t last_superframe[MAX_CODED_SUPERFRAME_SIZE + 4]; /* padding added */ + uint8_t last_superframe[MAX_CODED_SUPERFRAME_SIZE + FF_INPUT_BUFFER_PADDING_SIZE]; /* padding added */ int last_bitoffset; int last_superframe_len; float noise_table[NOISE_TAB_SIZE]; |